DETECTION & RESPONSE

Speed Up
Incident Investigations

Accelerate detection and response times with GreyNoise threat context

Get a Demo

Overview

GreyNoise accelerates investigations by adding context on IPs and CVEs seen in mass scanning and exploitation campaigns. This enrichment speeds triage, reduces manual work, and helps SOC teams more effectively investigate timelines and the scope of incidents.

How GreyNoise Speeds Up Investigations

Enriched Threat Context

GreyNoise shows whether an IP is scanning broadly or targeting specific systems, helping analysts gauge threat levels.

Identify Exploitation Attempts

CVE tags reveal which vulnerabilities are being exploited and which assets are likely targeted.

Map Attack Infrastructure

GreyNoise links IPs, ASNs, and behaviors so analysts can pivot and see the broader campaign.

Strengthen Containment Decisions

Intelligence on attacker infrastructure helps teams decide when to block, monitor, or expand containment.

Speed Up Timeline Construction

Data on first seen, last seen, and behavior give provides evidence for accurate incident timelines.

Better Documentation and Reporting

Enriched incident reports clarify what happened and why it matters.

‍

How it Works

Explore Available Fields

Filter by category & search available IP fields and their uses with GreyNoise.
Categories
Thank you! Your submission has been received!
Oops! Something went wrong while submitting the form.
NAME
Description & Use
ASN
Autonomous System Number routing the IP. Helps group malicious infrastructure.
ASN Count
Count of IPs grouped by ASN. Supports ASN-level threat analysis.
Actor
Known or attributed owner/operator of the IP (e.g., research org, ISP, hosting provider). Useful for attribution.
Actor Count
Aggregated count of IPs per actor. Supports statistical analysis of actors.
Bot
Flags whether the IP is part of known botnet activity. Helps detect automated scanning or malware distribution.
CVEs
CVEs tied to the tag behavior. Critical for identifying exploitation of known vulnerabilities.
Category
High-level network type (e.g., hosting, ISP, enterprise).
Category Count
Aggregated count of IPs per category (hosting, ISP, etc.). Highlights infrastructure trends.
City
Registered city of the IP. Useful for geolocation context and pivoting.
Classification
GreyNoise’s judgment of the IP’s intent: benign, malicious, suspicious, or unknown. Most useful filter for triage.
Classification Count
Aggregated count of IPs per classification. Useful for threat landscape analysis.
Created At
Date the tag was first added. Indicates when this behavior was first observed.
Description
Human-readable explanation of what the tag represents. Adds analyst context.
Destination ASNs
List of ASNs targeted by the IP. Helps show which networks are being scanned.
Destination Cities
List of cities where scanning traffic was observed. Useful for geo-targeting analysis.
Destination Countries
Countries where GreyNoise sensors saw this IP scanning. Indicates target geography.
Exploitation Activity Threat IP Count (1d)
Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability today.
Exploitation Activity Threat IP Count (30d)
Total number of threat IPs GreyNoise observed scanning or exploiting this vulnerability in the last 30 days. Useful for long-term prioritization and trend analysis.
Exploitation Details
Exploitation-related details pertaining to attack vector category, EPSS score (Exploit Prediction Scoring System), available exploits, and KEV (Known Exploited Vulnerabilities) registration. Guides whether to prioritize based on real-world attacker use.
Exploitation Details Attack Vector
The method attackers use to exploit the vulnerability (e.g., network, local, adjacent). Helps assess exposure across internet-facing vs. internal assets.
Exploitation Details EPSS Score
EPSS score (Exploit Prediction Scoring System) associated with the exploitation.
Exploitation Details Exploit Found
Indicates whether a working exploit is publicly available. Confirms attacker capability and should increase remediation priority.
Exploitation Details Registered in KEV
Whether exploitation has been registered in the KEV (Known Exploited Vulnerabilities) database.
Exploitation Stats
Statistical data about exploitation, including number of exploits available, and number of threat actors and botnets exploiting the vulnerability.
Exploitation Stats Number of Available Exploits
Total number of exploits available (public + commercial).
Exploitation Stats Number of Botnets Exploiting Vulnerability
Total number of botnets exploiting the vulnerability.
Exploitation Stats Number of Threat Actors Exploiting Vulnerability
Total number of known threat actors exploiting the vulnerability.
First Seen
Date the IP was first observed by GreyNoise. Indicates activity lifetime.
ID
Unique tag identifier.
ID
Unique identifier for the record. Used to track and reference the vulnerability consistently across systems and reports.
IP
The observed IP address itself. Primary entity to investigate or correlate across alerts.
Intention
Tag’s intent classification: benign, malicious, suspicious, or unknown. Adds risk context.

Cut the Noise. Close the Case.

Get a demo
Search for free
Products
Partners
Resources
Company
© 2025 GreyNoise, Inc. All rights reserved.
YouTube logoJoin us on Slack!Discord logoTikTok logo